Previewing raw data parsing

ABSTRACT

Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.15/224,655, filed Jul. 31, 2016, entitled “Interactive Selection AndDisplay Of A Raw Data Parsing,” which is a continuation of U.S.application Ser. No. 14/929,332, filed Oct. 31, 2015, now U.S. Pat. No.9,442,981, which is continuation of U.S. application Ser. No.14/445,001, filed Jul. 28, 2014, now U.S. Pat. No. 9,208,206, which is acontinuation of U.S. application Ser. No. 13/588,939, filed Aug. 17,2012, now U.S. Pat. No. 8,825,664, each of which is incorporated in itsentirety by reference herein.

BACKGROUND

The rapid increase in the production and collection of machine-generateddata has created large data sets that are difficult to search. Themachine data can include sequences of time stamped records that mayoccur in one or more usually continuous streams. Further, machine dataoften represents activity made up of discrete events.

Often, search engines may receive raw data from various data sources,including machine data. In some cases, search engines may be configuredto transform raw data in various ways prior to storing it as indexeddata. Sometimes the search engine configuration information used toprocess the received raw data may include improper and/or ineffectiverules that may generate ineffective index data. If such improper indexdata may be added to an index store it may pollute the index reducingthe quality of search results that may be produced.

BRIEF SUMMARY

This invention relates generally to information organization, search,and retrieval and more particularly, previewing search results beforereceived search engine data is indexed.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING

Non-limiting and non-exhaustive embodiments are described with referenceto the following drawings. In the drawings, like reference numeralsrefer to like parts throughout the various figures unless otherwisespecified.

For a better understanding, reference will be made to the followingDescription Of The Various Embodiments, which is to be read inassociation with the accompanying drawings, wherein:

FIG. 1. Illustrates a system environment in which various embodimentsmay be implemented;

FIG. 2A. Shows a schematic drawing of a rack of blade servers;

FIG. 2B. Illustrates a schematic embodiment of a blade server that maybe included in a rack of blade servers such as that shown in FIG. 2A;

FIG. 3. Shows a schematic embodiment of a mobile device;

FIG. 4. Illustrates a schematic embodiment of a network device;

FIG. 5. Shows an overview flowchart for an index previewing process inaccordance with at least one of the various embodiments;

FIG. 6. Shows a flowchart for a process to send preview data to a queuein accordance with at least one of the various embodiments;

FIG. 7. Shows a flowchart for a process for processing data chunks in apipeline in accordance with at least one of the various embodiments; and

FIG. 8. Illustrates a logical architecture of a system for indexingpreviewing in accordance with at least one of the various embodiments.

DETAILED DESCRIPTION OF THE INVENTION

Various embodiments now will be described more fully hereinafter withreference to the accompanying drawings, which form a part hereof, andwhich show, by way of illustration, specific exemplary embodiments bywhich the invention may be practiced. The embodiments may, however, beembodied in many different forms and should not be construed as limitedto the embodiments set forth herein; rather, these embodiments areprovided so that this disclosure will be thorough and complete, and willfully convey the scope of the embodiments to those skilled in the art.Among other things, the various embodiments may be methods, systems,media or devices. Accordingly, the various embodiments may take the formof an entirely hardware embodiment, an entirely software embodiment oran embodiment combining software and hardware aspects. The followingdetailed description is, therefore, not to be taken in a limiting sense.

Throughout the specification and claims, the following terms take themeanings explicitly associated herein, unless the context clearlydictates otherwise. The phrase “in one embodiment” as used herein doesnot necessarily refer to the same embodiment, though it may.Furthermore, the phrase “in another embodiment” as used herein does notnecessarily refer to a different embodiment, although it may. Thus, asdescribed below, various embodiments may be readily combined, withoutdeparting from the scope or spirit of the invention.

In addition, as used herein, the term “or” is an inclusive “or”operator, and is equivalent to the term “and/or,” unless the contextclearly dictates otherwise. The term “based on” is not exclusive andallows for being based on additional factors not described, unless thecontext clearly dictates otherwise. In addition, throughout thespecification, the meaning of “a,” “an,” and “the” include pluralreferences. The meaning of “in” includes “in” and “on.”

For example embodiments, the following terms are also used hereinaccording to the corresponding meaning, unless the context clearlydictates otherwise.

The term “machine data” as used herein may include server logs and othertypes of machine data (i.e., data generated by machines). In at leastone of the various embodiments, machine data streams may be time stampedto create time stamped events. For example, information processingenvironments, such as, firewalls, routers, web servers, applicationservers and databases may generate streams of time series data in theform of events. In some cases, events may be generated hundreds orthousands of times per second.

The term “time series data” as used herein is data where each datarecord has a timestamp associated with it. A “Time Series Search Engine”is a search engine which, in at least one of the various embodiments,can perform queries limited by a time range (such as between one timeand another, or data earlier than a given time, or the like) on thestored data and/or generate results ordered by time and/or timestamps(such as from earliest-to-latest or vice versa).

The term “data repository” as used herein refers to data sources thatmay contain unstructured or structured data, such as databases, filesystems, search engine indexes, or the like. In at least one of thevarious embodiments, a data repository may be a live stream of data. Inother cases, a data repository may be static data, or a combination oflive data or static data. In at least one of the various embodiments,data repositories may provide interfaces such as, applicationprogramming interfaces (API) for receiving requests, queries regardingthe data stored in the data repository.

The term “configuration information” as used herein refers to dataand/or directives that may be employed by an indexer application or apreviewing application for processing, such as indexing, transforming,and/or interpreting raw data received from data sources. Theconfiguration information may be saved using various storage mechanisms,such as, file systems, databases, computer memory, or the like.

Configuration information may include rules that may be comprised offilters, matching functions, rules for determining “event boundaries”within raw data and/or preview data (e.g., rules for dividing an eventstream into individual lines, rules for merging lines into multi-lineevents, or the like), rules for locating and parsing timestamps in rawdata and/or preview data, or the like. The configuration information maybe employed by the indexer application to identify events of interestthat may be included in machine-generated data, identify and extractfields within events, or the like.

The term “raw data” as used herein refers to non-indexed data before itis processed by an indexer application or a previewing application. Inat least one of the various embodiments, the raw data may bemachine-generated data. Indexer applications and previewing applicationsmay use the configuration information to determine how to interpret theraw data.

The term “preview data” as used herein refers to a portion of the rawdata that is received from a preview data source and designated foradditional processing. After the preview data is indexed by the indexerapplication, the preview index data is stored in a separate previewstore rather than being automatically stored in an index store. Once theconfiguration information for the preview index data is approved,subsequent raw data received from the preview data source isautomatically indexed and stored in the index store.

The term “index data” as used herein refers to raw data and/or previewdata that has been indexed and processed into a format suitable foradding to an index store by an indexer application. Indexer applicationsmay generate index data from raw data received from data sources and/orpreview data sources.

The term “worker agent” as used herein refers to processes that performactions on the raw data and/or preview data to transform it into indexdata and/or preview index data. Worker agents may employ configurationinformation to determine how to process the raw data and/or previewdata.

The term “queue” as used herein refers to system components that receivechunks of raw data and/or preview data from various data sources and/orpreview data sources. Queues may act as staging areas before the rawdata and/or preview data are further processed. Raw data and/or previewdata may be removed from a queue and transferred to one or morepipelines for further processing.

The term “pipeline” as used herein refers to system components that maybe associated with one or more processors, such as, worker agents. Insome embodiments, the first processor in a pipeline may be responsiblefor retrieving raw data chunks and/or preview data chunks from a queueand sending them to other processors. Other processors may performoperations on the raw data chunks and/or preview data chunks, such as,breaking the data into lines or extracting fields based on configurationinformation. In at least one of the various embodiments, the lastprocessor for a pipeline may transfer data chunks to another queue forconsumption by a different pipeline for additional processing. As datachunks advance through the pipeline, processors (e.g., worker agents)may process the raw data chunks and/or preview data chunks into indexdata and/or preview index data.

The term “query string” as used herein refers to commands and/orsequences of commands that are used for querying, searching and/orretrieving data from a data repository. Queries generally produce aresult or results based on the form and structure of the particularquery string. Query results may be sorted and grouped based on thestructure and form of the query string. In at least one of the variousembodiments, query strings may include commands, operators, functions,or the like for calculating values based on the stored records,including functions that produce result sets that may include statisticsand metrics about the data stored in data repository. Structured QueryLanguage (SQL) is a well-known query language often used to form queriesfor relational databases. However, the various embodiments are notlimited to using SQL-like formatting for query strings. Accordingly,other well known query languages and/or custom query languages may beemployed consistent with what is claimed herein.

The following briefly describes the embodiments of the invention inorder to provide a basic understanding of some aspects of the invention.This brief description is not intended as an extensive overview. It isnot intended to identify key or critical elements, or to delineate orotherwise narrow the scope. Its purpose is merely to present someconcepts in a simplified form as a prelude to the more detaileddescription that is presented later.

Briefly stated, various embodiments are directed towards previewing theresults generated from indexing raw data from selected preview datasources before the corresponding index data is added to an index store.In at least one of the various embodiments, raw data may be receivedfrom a preview data source, and/or data source. In at least one of thevarious embodiments, after an initial set of configuration informationis established, the preview data may be submitted to a pipeline that mayperform index processing on the preview data and other raw data. Thepreview index data is stored in a preview data store that is separatefrom the index data store that stores the indexed data.

In at least one of the various embodiments, a previewing application maygenerate preview results based on the preview index data and theconfiguration information. In at least one of the various embodiments,the preview results enable a user to view how the preview data is beingprocessed by the indexing application. In at least one of the variousembodiments, if the preview results may not be acceptable, theconfiguration information employed to generate the preview index datamay be modified.

In at least one of the various embodiments, the preview application mayenable iterative modification of the configuration information used forprocessing the preview data until the generated preview results may beacceptable. In at least one of the various embodiments, once theconfiguration information for the preview index data is approved,subsequent raw data received from the preview data source isautomatically indexed and stored in the index store.

Illustrative Operating Environment FIG. 1 shows components of anenvironment in which various embodiments may be practiced. Not all ofthe components may be required to practice the various embodiments, andvariations in the arrangement and type of the components may be madewithout departing from the spirit or scope of the various embodiments.

In at least one embodiment, cloud network 102 enables one or morenetwork services for a user based on the operation of correspondingarrangements 104 and 106 of virtually any type of networked computingdevice. As shown, the networked computing devices may include previewingserver device 112, indexing server device 114, enclosure of bladeservers 110, enclosure of server computers 116, super computer networkdevice 118, and the like. Although not shown, one or more mobile devicesmay be included in cloud network 102 in one or more arrangements toprovide one or more network services to a user. Also, these arrangementsof networked computing devices may or may not be mutually exclusive ofeach other.

Additionally, the user may employ a plurality of virtually any type ofwired or wireless networked computing devices to communicate with cloudnetwork 102 and access at least one of the network services enabled byone or more of arrangements 104 and 106. These networked computingdevices may include tablet mobile device 122, handheld mobile device124, wearable mobile device 126, desktop network device 120, and thelike. Although not shown, in various embodiments, the user may alsoemploy notebook computers, desktop computers, microprocessor-based orprogrammable consumer electronics, network appliances, mobiletelephones, smart telephones, pagers, radio frequency (RF) devices,infrared (IR) devices, Personal Digital Assistants (PDAs), televisions,integrated devices combining at least one of the preceding devices, andthe like.

One embodiment of a mobile device is described in more detail below inconjunction with FIG. 3. Generally, mobile devices may include virtuallyany substantially portable networked computing device capable ofcommunicating over a wired, wireless, or some combination of wired andwireless network.

In various embodiments, network 102 may employ virtually any form ofcommunication technology and topology. For example, network 102 caninclude local area networks Personal Area Networks (PANs), (LANs),Campus Area Networks (CANs), Metropolitan Area Networks (MANs) Wide AreaNetworks (W ANs), direct communication connections, and the like, or anycombination thereof. On an interconnected set of LAN s, including thosebased on differing architectures and protocols, a router acts as a linkbetween LAN s, enabling messages to be sent from one to another. Inaddition, communication links within networks may include virtually anytype of link, e.g., twisted wire pair lines, optical fibers, open airlasers or coaxial cable, plain old telephone service (POTS), waveguides, acoustic, full or fractional dedicated digital communicationlines including T1, T2, T3, and T4, and/or other carrier and other wiredmedia and wireless media. These carrier mechanisms may includeE-carriers, Integrated Services Digital Networks (ISDNs), universalserial bus (USB) ports, Firewire ports, Thunderbolt ports, DigitalSubscriber Lines (DSLs), wireless links including satellite links, orother communications links known to those skilled in the art. Moreover,these communication links may further employ any of a variety of digitalsignaling technologies, including without limit, for example, DS-0,DS-1, DS-2, DS-3, DS-4, OC-3, OC-12, OC-48, or the like. Furthermore,remotely located computing devices could be remotely connected tonetworks via a modem and a temporary communication link. In essence,network 102 may include virtually any communication technology by whichinformation may travel between computing devices. Additionally, in thevarious embodiments, the communicated information may include virtuallyany kind of information including, but not limited to processor-readableinstructions, data structures, program modules, applications, raw data,control data, archived data, video data, voice data, image data, textdata, and the like.

Network 102 may be partially or entirely embodied by one or morewireless networks. A wireless network may include any of a variety ofwireless sub-networks that may further overlay stand-alone ad-hocnetworks, and the like. Such sub-networks may include mesh networks,Wireless LAN (WLAN) networks, Wireless Router (WR) mesh, cellularnetworks, pico networks, PANs, Open Air Laser networks, Microwavenetworks, and the like. Network 102 may further include an autonomoussystem of intermediate network devices such as terminals, gateways,routers, switches, firewalls, load balancers, and the like, which arecoupled to wired and/or wireless communication links. These autonomousdevices may be operable to move freely and randomly and organizethemselves arbitrarily, such that the topology of network 102 may changerapidly.

Network 102 may further employ a plurality of wired and wireless accesstechnologies, e.g., 2nd (2G), 3rd (3G), 4th (4G), 5th (5G) generationwireless access technologies, and the like, for mobile devices. Thesewired and wireless access technologies may also include Global Systemfor Mobile communication (GSM), General Packet Radio Services (GPRS),Enhanced Data GSM Environment (EDGE), Code Division Multiple Access(CDMA), Wideband Code Division Multiple Access (WCDMA), Long TermEvolution Advanced (LTE), Universal Mobile Telecommunications System(UMTS), Orthogonal frequency-division multiplexing (OFDM), Wideband CodeDivision Multiple Access (W-CDMA), Code Division Multiple Access 2000(CDMA2000), Evolution-Data Optimized (EV-DO), High-Speed Downlink PacketAccess (HSDPA), IEEE 802.16 Worldwide Interoperability for MicrowaveAccess (WiMax), ultra wide band (UWB), user datagram protocol (UDP),transmission control protocol/Internet protocol (TCP/IP), any portion ofthe Open Systems Interconnection (OSI) model protocols, Short MessageService (SMS), Multimedia Messaging Service (MMS), Web Access Protocol(WAP), Session Initiation Protocol/Real-time Transport Protocol(SIP/RTP), or any of a variety of other wireless or wired communicationprotocols. In one non-limiting example, network 102 may enable a mobiledevice to wirelessly access a network service through a combination ofseveral radio network access technologies such as GSM, EDGE, SMS, HSDPA,LTE and the like.

Enclosure of Blade Servers

FIG. 2A shows one embodiment of an enclosure of blade servers 200, whichare also illustrated in FIG. 1. Enclosure of blade servers 200 mayinclude many more or fewer components than those shown in FIG. 2A.However, the components shown are sufficient to disclose an illustrativeembodiment. Generally, a blade server is a stripped down servercomputing device with a modular design optimized to minimize the use ofphysical space and energy. A blade enclosure can include several bladeservers and provide each with power, cooling, network interfaces,input/output interfaces, and resource management. Although not shown, anenclosure of server computers typically includes several computers thatmerely require a network connection and a power cord connection tooperate. Each server computer often includes redundant components forpower and interfaces.

As shown in the figure, enclosure 200 contains power supply 204, andinput/output interface 206, rack logic 208, several blade servers 210,212, 214, and 216, and backplane 202. Power supply 204 provides power toeach component and blade server within the enclosure. The input/outputinterface 206 provides internal and external communication forcomponents and blade servers within the enclosure. Backplane 208 canenable passive and active communication of power, logic, input signals,and output signals for each blade server.

Illustrative Blade Server

FIG. 2B illustrates an illustrative embodiment of blade server 250,which may include many more or fewer components than those shown. Asshown in FIG. 2A, a plurality of blade servers may be included in oneenclosure that shares resources provided by the enclosure to reducesize, power, and cost.

Blade server 250 includes processor 252 which communicates with memory256 via bus 254. Blade server 250 also includes input/output interface290, processor-readable stationary storage device 292, andprocessor-readable removable storage device 294. Input/output interface290 can enable blade server 250 to communicate with other blade servers,mobile devices, network devices, and the like. Interface 290 may providewireless and/or wired communication links for blade server.Processor-readable stationary storage device 292 may include one or moredevices such as an electromagnetic storage device (hard disk), solidstate hard disk (SSD), hybrid of both an SSD and a hard disk, and thelike. In some configurations, a blade server may include multiplestorage devices. Also, processor-readable removable storage device 294enables processor 252 to read non-transitive storage media for storingand accessing processor-readable instructions, modules, data structures,and other forms of data. The non-transitive storage media may includeFlash drives, tape media, floppy media, and the like.

Memory 256 may include Random Access Memory (RAM), Read-Only Memory(ROM), hybrid of RAM and ROM, and the like. As shown, memory 256includes operating system 258 and basic input/output system (BIOS) 260for enabling the operation of blade server 250. In various embodiments,a general-purpose operating system may be employed such as a version ofUNIX, LINUX™, a specialized server operating system such as Microsoft'sWindows Server™ and Apple Computer's IoS Server™, or the like.

Memory 256 further includes one or more data storage 270, which can beutilized by blade server 250 to store, among other things, applications280 and/or other data. Data stores 270 may include program code, data,algorithms, and the like, for use by processor 252 to execute andperform actions. In one embodiment, at least some of data store 270might also be stored on another component of blade server 250,including, but not limited to, processor readable removable storagedevice 294, processor-readable stationary storage device 292, or anyother processor-readable storage device (not shown). Data storage 270may include, for example, preview data 274, indexes 276, orconfigurations 278.

Applications 280 may include processor executable instructions which,when executed by blade server 250, transmit, receive, and/or otherwiseprocess messages, audio, video, and enable communication with othernetworked computing devices. Examples of application programs includedatabase servers, file servers, calendars, transcoders, and so forth.Applications 280 may include, for example, indexer application 282, andpreviewing application 284.

Human interface components (not pictured), may be remotely associatedwith blade server 250, which can enable remote input to and/or outputfrom blade server 250. For example, information to a display or from akeyboard can be routed through the input/output interface 290 toappropriate peripheral human interface components that are remotelylocated. Examples of peripheral human interface components include, butare not limited to, an audio interface, a display, keypad, pointingdevice, touch interface, and the like.

Illustrative Mobile Device

FIG. 3 shows one embodiment of mobile device 300 that may include manymore or less components than those shown. Mobile device 300 mayrepresent, for example, at least one embodiment of mobile devices shownin FIG. 1.

Mobile device 300 includes processor 302 in communication with memory304 via bus 328. Mobile device 300 also includes power supply 330,network interface 332, audio interface 356, display 350, keypad 352,illuminator 354, video interface 342, input/output interface 338, hapticinterface 364, global positioning systems (GPS) receiver 358, Open airgesture interface 360, temperature interface 362, camera(s) 340,projector 346, pointing device interface 366, processor-readablestationary storage device 334, and processor-readable removable storagedevice 336. Power supply 330 provides power to mobile device 300. Arechargeable or nonrechargeable battery may be used to provide power.The power may also be provided by an external power source, such as anAC adapter or a powered docking cradle that supplements and/or rechargesthe battery. And in one embodiment, although not shown, a gyroscope maybe employed within mobile device 300 to measuring and/or maintaining anorientation of mobile device 300.

Mobile device 300 may optionally communicate with a base station (notshown), or directly with another computing device. Network interface 332includes circuitry for coupling mobile device 300 to one or morenetworks, and is constructed for use with one or more communicationprotocols and technologies including, but not limited to, protocols andtechnologies that implement any portion of the Open SystemsInterconnection (OSI) model for mobile communication (GSM), codedivision multiple access (CDMA), time division multiple access (TDMA),user datagram protocol (UDP), transmission control protocol/Internetprotocol (TCP/IP), Short Message Service (SMS), Multimedia MessagingService (MMS), general packet radio service (GPRS), Web Access Protocol(WAP), ultra wide band (UWB), IEEE 802.16 Worldwide Interoperability forMicrowave Access (WiMax), Session Initiation Protocol/Realtime TransportProtocol (SIP/RTP), General Packet Radio Services (GPRS), Enhanced DataGSM Environment (EDGE), Wideband Code Division Multiple Access (WCDMA),Long Term Evolution Advanced (LTE), Universal Mobile TelecommunicationsSystem (UMTS), Orthogonal frequency-division multiplexing (OFDM), CodeDivision Multiple Access 2000 (CDMA2000), Evolution-Data Optimized(EV-DO), High-Speed Downlink Packet Access (HSDPA), or any of a varietyof other wireless communication protocols. Network interface 332 issometimes known as a transceiver, transceiving device, or networkinterface card (NIC).

Audio interface 356 is arranged to produce and receive audio signalssuch as the sound of a human voice. For example, audio interface 356 maybe coupled to a speaker and microphone (not shown) to enabletelecommunication with others and/or generate an audio acknowledgementfor some action. A microphone in audio interface 356 can also be usedfor input to or control of mobile device 300, e.g., using voicerecognition, detecting touch based on sound, and the like.

Display 350 may be a liquid crystal display (LCD), gas plasma,electronic ink, light emitting diode (LED), Organic LED (OLED) or anyother type of light reflective or light transmissive display that can beused with a computing device. Display 350 may also include a touchinterface 344 arranged to receive input from an object such as a stylusor a digit from a human hand, and may use resistive, capacitive, surfaceacoustic wave (SAW), infrared, radar, or other technologies to sensetouch and/or gestures. Projector 346 may be a remote handheld projectoror an integrated projector that is capable of projecting an image on aremote wall or any other reflective object such as a remote screen.

Video interface 342 may be arranged to capture video images, such as astill photo, a video segment, an infrared video, or the like. Forexample, video interface 342 may be coupled to a digital video camera, aweb-camera, or the like. Video interface 342 may comprise a lens, animage sensor, and other electronics. Image sensors may include acomplementary metaloxide-semiconductor (CMOS) integrated circuit,charge-coupled device (CCD), or any other integrated circuit for sensinglight.

Keypad 352 may comprise any input device arranged to receive input froma user. For example, keypad 352 may include a push button numeric dial,or a keyboard. Keypad 352 may also include command buttons that areassociated with selecting and sending images. Illuminator 354 mayprovide a status indication and/or provide light. Illuminator 354 mayremain active for specific periods of time or in response to events. Forexample, when illuminator 354 is active, it may backlight the buttons onkeypad 352 and stay on while the mobile device is powered. Also,illuminator 354 may backlight these buttons in various patterns whenparticular actions are performed, such as dialing another mobile device.Illuminator 354 may also cause light sources positioned within atransparent or translucent case of the mobile device to illuminate inresponse to actions.

Mobile device 300 also comprises input/output interface 338 forcommunicating with external peripheral devices or other computingdevices such as other mobile devices and network devices. The peripheraldevices may include an audio headset, display screen glasses, remotespeaker system, remote speaker and microphone system, and the like.Input/output interface 338 can utilize one or more technologies, such asUniversal Serial Bus (USB), Infrared, WiFi, WiMax, Bluetooth™, and thelike. Haptic interface 364 is arranged to provide tactile feedback to auser of the mobile device. For example, the haptic interface 364 may beemployed to vibrate mobile device 300 in a particular way when anotheruser of a computing device is calling. Temperature interface 362 may beused to provide a temperature measurement input and/or a temperaturechanging output to a user of mobile device 300. Open air gestureinterface 360 may sense physical gestures of a user of mobile device300, for example, by using single or stereo video cameras, radar, agyroscopic sensor inside a device held or worn by the user, or the like.Camera 340 may be used to track physical eye movements of a user ofmobile device 300.

GPS transceiver 358 can determine the physical coordinates of mobiledevice 300 on the surface of the Earth, which typically outputs alocation as latitude and longitude values. GPS transceiver 358 can alsoemploy other geo-positioning mechanisms, including, but not limited to,triangulation, assisted GPS (AGPS), Enhanced Observed Time Difference(E-OTD), Cell Identifier (CI), Service Area Identifier (SAi), EnhancedTiming Advance (ETA), Base Station Subsystem (BSS), or the like, tofurther determine the physical location of mobile device 300 on thesurface of the Earth. It is understood that under different conditions,GPS transceiver 358 can determine a physical location for mobile device300. In at least one embodiment, however, mobile device 300 may, throughother components, provide other information that may be employed todetermine a physical location of the device, including for example, aMedia Access Control (MAC) address, IP address, and the like.

Human interface components can be peripheral devices that are physicallyseparate from mobile device 300, allowing for remote input and/or outputto mobile device 300. For example, information routed as described herethrough human interface components such as display 350 or keyboard 352can instead be routed through network interface 332 to appropriate humaninterface components located remotely. Examples of human interfaceperipheral components that may be remote include, but are not limitedto, audio devices, pointing devices, keypads, displays, cameras,projectors, and the like. These peripheral components may communicateover a Pico Network such as Bluetooth™, Zigbee™ and the like. Onenon-limiting example of a mobile device with such peripheral humaninterface components is a wearable computing device, which might includea remote pico projector along with one or more cameras that remotelycommunicate with a separately located mobile device to sense a user'sgestures toward portions of an image projected by the pico projectoronto a reflected surface such as a wall or the user's hand.

A mobile device may include a browser application that is configured toreceive and to send web pages, web-based messages, graphics, text,multimedia, and the like. The mobile device's browser application mayemploy virtually any programming language, including a wirelessapplication protocol messages (W AP), and the like. In at least oneembodiment, the browser application is enabled to employ Handheld DeviceMarkup Language (HDML), Wireless Markup Language (WML), WMLScript,JavaScript, Standard Generalized Markup Language (SGML), HyperTextMarkup Language (HTML), eXtensible Markup Language (XML), HTML5, and thelike.

Memory 304 may include Random Access Memory (RAM), Read-Only Memory(ROM), and/or other types of memory. Memory 304 illustrates an exampleof computer-readable storage media (devices) for storage of informationsuch as computer-readable instructions, data structures, program modulesor other data. Memory 304 stores a basic input/output system (BIOS) 308for controlling low-level operation of mobile device 300. The memoryalso stores an operating system 306 for controlling the operation ofmobile device 300. It will be appreciated that this component mayinclude a general-purpose operating system such as a version of UNIX, orLINUX™, or a specialized mobile computer communication operating systemsuch as Windows Mobile™, or the Symbian® operating system. The operatingsystem may include, or interface with a Java virtual machine module thatenables control of hardware components and/or operating systemoperations via Java application programs.

Memory 304 further includes one or more data storage 310, which can beutilized by mobile device 300 to store, among other things, applications320 and/or other data. For example, data storage 310 may also beemployed to store information that describes various capabilities ofmobile device 300. The information may then be provided to anotherdevice based on any of a variety of events, including being sent as partof a header during a communication, sent upon request, or the like. Datastorage 310 may also be employed to store social networking informationincluding address books, buddy lists, aliases, user profile information,or the like. Data storage 310 may further include program code, data,algorithms, and the like, for use by a processor, such as processor 302to execute and perform actions. In one embodiment, at least some of datastorage 310 might also be stored on another component of mobile device300, including, but not limited to, non-transitory processor-readableremovable storage device 336, processor-readable stationary storagedevice 334, or even external to the mobile device. Data storage 310 mayinclude, for example, preview data 314.

Applications 320 may include computer executable instructions which,when executed by mobile device 300, transmit, receive, and/or otherwiseprocess instructions and data. Applications 320 may include, forexample, previewing application 322. Other examples of applicationprograms include calendars, search programs, email client applications,IM applications, SMS applications, Voice Over Internet Protocol (VOiP)applications, contact managers, task managers, transcoders, databaseprograms, word processing programs, security applications, spreadsheetprograms, games, search programs, and so forth.

Illustrative Network Device

FIG. 4 shows one embodiment of network device 400 that may be includedin a system implementing the invention. Network device 400 may includemany more or less components than those shown in FIG. 4. However, thecomponents shown are sufficient to disclose an illustrative embodimentfor practicing the present invention. Network device 400 may represent,for example, one embodiment of at least one of previewing server device112, indexing server device 114, or 120 of FIG. 1.

As shown in the figure, network device 400 includes a processor 402 incommunication with a memory 404 via a bus 428. Network device 400 alsoincludes a power supply 430, network interface 432, audio interface 456,display 450, keyboard 452, input/output interface 438,processor-readable stationary storage device 434, and processor-readableremovable storage device 436. Power supply 430 provides power to networkdevice 400.

Network interface 432 includes circuitry for coupling network device 400to one or more networks, and is constructed for use with one or morecommunication protocols and technologies including, but not limited to,protocols and technologies that implement any portion of the OpenSystems Interconnection model (OSI model), global system for mobilecommunication (GSM), code division multiple access (CDMA), time divisionmultiple access (TDMA), user datagram protocol (UDP), transmissioncontrol protocol/Internet protocol (TCP/IP), Short Message Service(SMS), Multimedia Messaging Service (MMS), general packet radio service(GPRS), W AP, ultra wide band (UWB), IEEE 802.16 WorldwideInteroperability for Microwave Access (WiMax), Session InitiationProtocol/Real-time Transport Protocol (SIP/RTP), or any of a variety ofother wired and wireless communication protocols. Network interface 432is sometimes known as a transceiver, transceiving device, or networkinterface card (NIC). Network device 400 may optionally communicate witha base station (not shown), or directly with another computing device.

Audio interface 456 is arranged to produce and receive audio signalssuch as the sound of a human voice. For example, audio interface 456 maybe coupled to a speaker and microphone (not shown) to enabletelecommunication with others and/or generate an audio acknowledgementfor some action. A microphone in audio interface 456 can also be usedfor input to or control of network device 400, for example, using voicerecognition.

Display 450 may be a liquid crystal display (LCD), gas plasma,electronic ink, light emitting diode (LED), Organic LED (OLED) or anyother type of light reflective or light transmissive display that can beused with a computing device. Display 450 may be a handheld projector orpico projector capable of projecting an image on a wall or other object.

Network device 400 also may also comprise input/output interface 438 forcommunicating with external devices not shown in FIG. 4. Input/outputinterface 438 can utilize one or more wired or wireless communicationtechnologies, such as USB™, Firewire™ WiFi, WiMax, Thunderbolt™,Infrared, Bluetooth™, Zigbee™, serial port, parallel port, and the like.

Human interface components can be physically separate from networkdevice 400, allowing for remote input and/or output to network device400. For example, information routed as described here through humaninterface components such as display 450 or keyboard 452 can instead berouted through the network interface 432 to appropriate human interfacecomponents located elsewhere on the network. Human interface componentsinclude any component that allows the computer to take input from, orsend output to, a human user of a computer.

Memory 404 may include Random Access Memory (RAM), Read-Only Memory(ROM), and/or other types of memory. Memory 404 illustrates an exampleof computer-readable storage media (devices) for storage of informationsuch as computer-readable instructions, data structures, program modulesor other data. Memory 404 stores a basic input/output system (BIOS) 408for controlling low-level operation of network device 400. The memoryalso stores an operating system 406 for controlling the operation ofnetwork device 400. It will be appreciated that this component mayinclude a general-purpose operating system such as a version of UNIX, orLINUX™, or a specialized operating system such as MicrosoftCorporation's Windows® operating system, or the Apple Corporation's IOs®operating system. The operating system may include, or interface with aJava virtual machine module that enables control of hardware componentsand/or operating system operations via Java application programs.

Memory 404 further includes one or more data storage 410, which can beutilized by network device 400 to store, among other things,applications 420 and/or other data. For example, data storage 410 mayalso be employed to store information that describes variouscapabilities of network device 400. The information may then be providedto another device based on any of a variety of events, including beingsent as part of a header during a communication, sent upon request, orthe like. Data storage 410 may also be employed to store socialnetworking information including address books, buddy lists, aliases,user profile information, or the like. Data stores 410 may furtherinclude program code, data, algorithms, and the like, for use by aprocessor, such as processor 402 to execute and perform actions. In oneembodiment, at least some of data store 410 might also be stored onanother component of network device 400, including, but not limited to,non-transitory media inside processor-readable removable storage device436, processor-readable stationary storage device 434, or any othercomputer-readable storage device within network device 400, or evenexternal to network device 400. Data storage 410 may include, forexample, indexes 412, preview data 414, and configurations 416.

Applications 420 may include computer executable instructions which,when executed by network device 400, transmit, receive, and/or otherwiseprocess messages (e.g., SMS, Multimedia Messaging Service (MMS), InstantMessage (IM), email, and/or other messages), audio, video, and enabletelecommunication with another user of another mobile device. Otherexamples of application programs include calendars, search programs,email client applications, IM applications, SMS applications, Voice OverInternet Protocol (VOiP) applications, contact managers, task managers,transcoders, database programs, word processing programs, securityapplications, spreadsheet programs, games, search programs, and soforth. Applications 420 may include, for example, indexer application422, and previewing application 424.

Generalized Operation

FIGS. 5-7 represent the generalized operation of indexing preview inaccordance with at least one of the various embodiments.

FIG. 5 shows an overview flowchart for index previewing process 500 inaccordance with at least one of the various embodiments. After at startblock, at block 502, in at least one of the various embodiments,determine one or more preview data sources and receive a portion of rawdata from the determined preview data source. In at least one of thevarious embodiments, determining a preview data source may be based ontype of index and/or search engine that may use the collected data.

In at least one of the various embodiments, preview data sources may beselected by browsing with a user-interface. Also, in at least one of thevarious embodiments, preview data sources may be selected based on oneor more system configuration values and/or default values.

In at least one of the various embodiments, raw data may includeunstructured data (e.g., machine data and/or log files) and/orstructured data (e.g., database result sets, XML files, or the like). Inat least one of the various embodiments, raw data may be received and/orprocessed in chunks, packets, streams, or the like.

In at least one of the various embodiments, if the preview data sourceincludes a large data set, the previewing application may retrieve aportion of the data set sufficient to generate acceptable previewresults. In at least one of the various embodiments, the amount of datacollected may be determined on a default and/or pre-set maximum value(e.g., 2 mb). Also, in at least one of the various embodiments, thepreviewing application may scan the preview data as it is received anddetermine based on patterns in the data that enough data has beenreceived to generate a preview. In at least one of the variousembodiments, if additional data is required, the portion size may beincreased based on user feedback. Further, in at least one of thevarious embodiments, the previewing application may determine that moredata from the preview data source may be required based on a failure toproduce sufficient preview results.

At block 504, in at least one of the various embodiments, determine theinitial configuration information that may be employed to process thepreview data. In at least one of the various embodiments, initialconfiguration information may be determined based on in part defaultvalues for the system, default values for a user, values set by a userbefore receiving the data, or the like. Also, in at least one of thevarious embodiments, a previewing application may detect patterns in theinitial data portions that may be employed to determine a set of initialconfiguration information. For example, in at least one of the variousembodiments, the previewing application may scan the data received fromthe preview data source and determine that it includes data patternsthat may be similar to those expected for web server access logs. Inthis case, in at least one of the various embodiments, the previewingapplication may determine that the initial configuration information mayinclude previously defined rules for processing web server access logs.

At block 506, in at least one of the various embodiments, furtherdetermine the candidate configuration information that may be employedto process the data received from the preview data source. In at leastone of the various embodiments, the user and/or the system may modifythe candidate configuration information. In at least one of the variousembodiments, changes to the candidate configuration information may bebased on the type of data being received as well as the purpose and/ortype of report the system may be expected to produce.

In at least one of the various embodiments, a user may modify thecandidate configuration information by adding sets of rules that may beselected from among one or more proposed rules presented in auser-interface. In at least one of the various embodiments, proposedrules may be comprised of filters, matching functions, or the like thatmay be arranged to respond to characteristics of the raw data. Forexample, in at least one of the various embodiments, an indexingapplication may provide one or more rules for matching web page uniformresource locators (URLs) that may be included in access log files for aweb server. In at least one of the various embodiments, such rules mayinclude one or more well-known regular expressions that may be employedto match string patterns that match the pattern of a web URL (e.g.,url=htt*). In other cases, a user may modify the configurationinformation to prevent unwanted URLs from appearing in the indexed databy adding rules that may exclude the unwanted URLs.

At block 508, in at least one of the various embodiments, the raw datamay be processed based on configuration information that may beassociated with the raw data and the results may be provided to theuser.

In at least one of the various embodiments, if the preview results maynot be available, progress metrics related to the previewing process maybe shown to a user. Also, if a portion of the preview results may beavailable, the portion of the results may be provided along with thepreviewing progress metrics.

At decision block 510, in at least one of the various embodiments, ifthe results generated based on the preview data processing aresatisfactory, control may move to block 510. Otherwise, in at least oneof the various embodiments, control may loop back to block 504 for toreceive further modification to the configuration information.

In at least one of the various embodiments, preview results may be usedto determine if the correct timestamp is being associated with theevents included in the raw data. Also, in at least one of the variousembodiments, by examining the preview results a user may determine ifthe delineation between events included in the raw data is correct.

At block 512, in at least one of the various embodiments, the candidateconfiguration information may be approved and committed to stablestorage. In at least one of the various embodiments, committedconfiguration information may be associated with one or more datasources and employed by an indexer application to process raw data intoindex data that may be stored in production index stores and madeavailable for responding to search requests.

In at least one of the various embodiments, configuration informationmay be stored in a file system and/or a database and made available toother users that may be processing data similar to the data that is inthe preview data store. Next, in at least one of the variousembodiments, control may be returned to a calling process.

FIG. 6 shows a flowchart for process 600 to provide preview data to aqueue in accordance with at least one of the various embodiments. Aftera start block, at block 602, in at least one of the various embodiments,preview data chunks may be generated from the data received from thepreview data source.

At block 604, in at least one of the various embodiments, the raw datamay be tagged and/or marked to indicate that it may be intended for useas preview data. Also, in at least one of the various embodiments, thecurrent candidate configuration information may be associated with thepreview data.

In at least one of the various embodiments, raw data may be arrangedand/or processed in chunks, packets, streams, or the like. In at leastone of the various embodiments, tag and/or mark each raw data chunk thatmay include preview data as preview data chunks.

At block 606, in at least one of the various embodiments, submit thepreview data to one or more queues so worker agents may retrieve thepreview data from the queues and transfer it to a pipeline for furtherprocessing based on the associated candidate configuration information.Next, in at least one of the various embodiments, control may bereturned to a calling process.

FIG. 7 shows a flowchart for process 700 for processing data in apipeline in accordance with at least one of the various embodiments.After a start block, at block 702, in at least one of the variousembodiments, generate index data from raw data that may be in thepipeline and/or generate preview index data from the preview data.

In at least one of the various embodiments, preview index data may begenerated by an indexer application that processes preview data frompreview data sources. Also, index data may be generated by an indexerapplication that processes raw data from non-preview data sources. In atleast one of the various embodiments, an indexer application may takeraw data and apply the configuration information to generate index datacorresponding to the source of the raw data and/or the type of resultsexpected/desired to be included in the index.

Also, in at least one of the various embodiments, index data chunks maybe generated by an indexer application that processes raw data chunksfrom preview data sources and/or production (non-preview) data sources.In at least one of the various embodiments, an indexer application maytake raw data chunks and apply one or more sets of configurationinformation to generate index data chunks corresponding to the raw datachunk and/or the type of results expected/desired to be included in theindex.

For example, in at least one of the various embodiments, if raw dataincludes information from web server access logs, an indexer applicationmay be configured to extract properties and features known to beincluded in web server log file records, such as, http methods, URLs,HTTP headers (e.g., user-agent, cookie, referrer, or the like), responsecodes, or the like.

At decision block 704, in at least one of the various embodiments, ifthe generated index data may be from preview data (e.g., originatingfrom a preview data source), control may move to block 706. Otherwise,in at least one of the various embodiments, control may move to block710.

In at least one of the various embodiments, a previewing application maydetermine if an preview index data chunk is associated with preview datachunks by determining if there is an indicative tag and/or marker in thepreview index data chunk.

At block 706, in at least one of the various embodiments, generatepreview result data from the preview index data. In at least one of thevarious embodiments, preview result data may be generated by executingone or more search commands and/or query commands against the dataincluded in the preview data chunk and the preview index data.

At block 708, in at least one of the various embodiments, the generatedpreview search results data may be stored into a preview data store. Inat least one of the various embodiments, a preview data store may beseparate from the index stores.

In at least one of the various embodiments, storing the preview resultsdata in the preview data store may preserve the preview results enablingusers to retrieve and view the results. In at least one of the variousembodiments, the previewing application may enable the stored previewsresults to be viewed using client applications, including previewingapplication 322 that may be operative on client devices, such as mobiledevice 300. In at least one of the various embodiments, preview resultsdata may be viewed in graphical user-interfaces that enable users toview the effectiveness of the candidate configuration information thatmay have been employed to generate the preview results.

In at least one of the various embodiments, the progress of thepreviewing process may be tracked enabling relevant metrics related tothe on going previewing process to be generated and displayed to a user.In at least one of the various embodiments, progress may be tracked bymonitoring the number of preview index data chunks that may be generatedby the indexer application. In at least one of the various embodiments,a metric based on the ratio of the number of preview index data chunksthat have been written to the preview store to the number of previewindex data chucks needed for presenting results may be calculated anddisplayed. In at least one of the various embodiments, the number ofpreview index data chunks needed for presenting preview results mayvary. The number of preview index data chunks required may depend on thetype of preview data being processed and/or the type of preview resultsbeing generated. In at least one of the various embodiments, theparticular configuration values for generating progress metrics (e.g.,ratio denominators) may be supplied by a user and/or retrieved from theconfiguration information.

At block 710, in at least one of the various embodiments, the processedindex data may be added to one or more index data stores. In at leastone of the various embodiments, production/non-preview index dataproduced by the indexer application may be routed to one or moreproduction index stores to support search requests from users.

At decision block 712, in at least one of the various embodiments, ifthere may be more data in the pipeline, control may loop back to block702. Otherwise, in at least one of the various embodiments, control maybe returned to a calling process.

It will be understood that figures, and combinations of actions in theflowchart-like illustrations, can be implemented by computer programinstructions. These program instructions may be provided to a processorto produce a machine, such that the instructions executing on theprocessor create a means for implementing the actions specified in theflowchart blocks. The computer program instructions may be executed by aprocessor to cause a series of operational actions to be performed bythe processor to produce a computer implemented process for implementingthe actions specified in the flowchart block or blocks. These programinstructions may be stored on some type of machine readable storagemedia, such as processor readable nontransitive storage media, or thelike.

Illustrative Indexing Preview Architecture

FIG. 8 illustrates for at least one of the various embodiments a logicaloverview of system 800 for previewing indexing. In at least one of thevarious embodiments, a search engine indexing system may be receivingdata from one or more data sources, such as data sources 802-804, usingone or more various input methods. In at least one of the variousembodiments, data sources may include files, data streams, databases, orthe like. Likewise, in at least one of the various embodiments, inputmethods may include reading files from disk, reading files fromnetworked file systems, network connections to data streams, or thelike.

In at least one of the various embodiments, data sources 802-804 mayprovide raw data that may be grouped/collected into data chunks that maybe provided to one or more queues, such as queue 808. In at least one ofthe various embodiments, indexer application 422 may provide chunks ofdata from the data sources to queue 808.

In at least one of the various embodiments, processors, such as workeragents may transfer the received data chunks to the pipeline forprocessing.

In at least one of the various embodiments, appropriate worker agents(not shown) included in indexer application 422 may process the receiveddata as it moves through pipeline 810. In at least one of the variousembodiments, raw data may be received and/or processed in chunks,packets, streams, or the like. One of ordinary skill in the art willappreciate that the subject matter claimed herein applies whether theraw data, index data, preview data, or like, is received and/or arrangedin chunks, packets, streams, or the like.

In at least one of the various embodiments, the worker agents may parseand process the received data chunks, such as data chunk 812,transforming the raw data into a form that is suitable for indexing(e.g., index data). In at least one of the various embodiments, if thedata chunks may be processed and transformed into index data chunkswithout error, the index data chunks may be added to the appropriateindex store, such as index store 822-824.

In at least one of the various embodiments, index stores 822-824 mayinclude data organized to support search engine searches and/or queries.In at least one of the various embodiments, indexer application 422 mayincrementally update the index stores as new index data is received frompipeline 810.

In at least one of the various embodiments, the worker agents may employconfiguration information that provides rules and/or filters forinfluencing how the worker agents parse and organize the raw data chunksfor indexing.

In at least one of the various embodiments, configuration informationemployed by the worker agents may be configured by users that havesufficient knowledge about the format of the raw data expected to bereceived from the data sources. In at least one of the variousembodiments, one or more different types of data may be received fromthe same data source. Thus, in at least one of the various embodiments,configuration information associated with a data source may includerules and filters appropriate for more than one type of data.

In at least one of the various embodiments, if pipeline 810 encountersdata chunks that cause one or more errors to be generated duringprocessing, each error may be logged and one or more users may benotified. Also, in at least one of the various embodiments, the raw datachunks and index data chunks associated with each error may be excludedfrom the one or more index stores until the error may be resolved.

However, in at least one of the various embodiments, data chunks thatmay be parsed incorrectly producing search results that are unexpectedand/or undesired may not always generate a system error. In at least oneof the various embodiments, worker agents may successfully process datachunks based on incorrect configuration information. For example, theconfiguration information may include filters that exclude data a userexpects to be indexed. Or, in at least one of the various embodiments,improperly arranged configuration information may lack sufficient rulesto extract and/or organize the raw data chunks as expected/desired bythe user.

In at least one of the various embodiments, raw data chunks that may beimproperly parsed because of improper configuration information mayproceed through pipeline 810 and be added to an index store. In at leastone of the various embodiments, the improperly processed index data maypollute an index, degrading the effectiveness and usefulness of theentire index store.

In at least one of the various embodiments, previewing application 424may be employed to preview the effect of the configuration informationon raw data chunks from a data source. In at least one of the variousembodiments, the raw data chunks may be converted into preview indexdata chunks and previewed before being added to one or more indexstores. This may enable, in at least one of the various embodiments, theeffect of the rules and/or filters in the configuration information maybe tested and observed without polluting the index stores.

In at least one of the various embodiments, previewing application 424may be employed to determine a preview data source, such as previewsource 806. In at least one of the various embodiments, a preview sourcemay be a source of raw data that may be provided by various sourcessimilar to data sources. Also, in at least one of the variousembodiments, preview source 806 may provide data using various inputmethods similar to data sources 802-804. In at least one of the variousembodiments, previewing application 424 may generate or determinecandidate configuration data for the raw data received from previewsource 806. In at least one of the various embodiments, previewingapplication 424 may attach/associate the configuration data to the rawpreview data chunk before submitting the data chunk to queue 808.

In at least one of the various embodiments, previewing application 424may retrieve a portion of the data available in preview source 806 forpreview processing rather than retrieving all of the data available atthe preview source. The portion size used for preview processing may bedetermined by a configuration rule that may be read from auser-interface, configuration file, database, or the like. For example,in at least one of the various embodiments, if a preview source includesa two gigabyte log file, the previewing application may be configured toread two megabytes of the file for preview processing.

In at least one of the various embodiments, preview application 424 mayread data from the preview source until the received data may bedetected to match the signature and/or pattern of known data typescorresponding to other configuration information.

In at least one of the various embodiments, preview application 424 mayenable a user to determine the parsing and field extraction rules from aset of available rules. Also, in at least one of the variousembodiments, a user may create new and/or custom rules that build uponexisting rules. In at least one of the various embodiments, a user mayalso generate new rules as well.

In at least one of the various embodiments, configuration informationmay be generated using a user-interface that provides access to one ormore available rules. In some cases, rules that may be determined toclosely match the data found in the preview data may be highlightedand/or presented in such a way to hint to the user that they may berelevant to previewing the data received from the preview source.

In at least one of the various embodiments, previewing application 424may generate one or more preview data chunks from preview data source806. Further, in at least one of the various embodiments, previewingapplication 424 may associate the candidate configuration informationwith the preview data chunk. Also, in at least one of the variousembodiments, the preview data chunk may be further tagged and/or markedby storing a value in the data chunk that identifies it as a previewdata chunk.

In at least one of the various embodiments, if the candidateconfiguration information is associated with the one or more previewdata chunks and they have been marked as preview data chunks, thepreviewing application may send the one or more data chunks to queue808.

In at least one of the various embodiments, preview data chunks may beprocessed in the pipeline similarly as non-preview data chunks. In atleast one of the various embodiments, one or more worker agents mayemploy the configuration information associated with the preview datachunk that is being processed. Worker agents may employ the candidateconfiguration information to provide rules and information directing theworker agents how to parse and organize the received preview datachunks. In at least one of the various embodiments, the worker agentsmay employ the configuration information to control how the preview datachunks are parsed and organized for indexing.

In at least one of the various embodiments, data chunk 814 may include aheader 816 and 818 data section. In at least one of the variousembodiments, if data chunk 814 may be preview data chunk, header 816 mayinclude a tag, key, or value that indicates that the data chunk is apreview data chunk. Also, in at least one of the various embodiments,header 816 may include a reference and/or pointer to the candidateconfiguration information that may be associated with the preview datachunk.

In at least one of the various embodiments, candidate configurationinformation may be included in header 816 or it may be included inanother portion of the preview data chunk with an offset and/orreference pointing to the configuration information stored in theheader.

In at least one of the various embodiments, data section 818 may includethe raw data from the data source and/or it may contain the data as itis processed into index data by the various worker agents that work onthe data chunk as it progresses through pipeline 810.

In at least one of the various embodiments, as worker agents completeprocessing of the raw data chunks and preview data chunks into indexdata and preview index data, respectively, the data chunks may reach theend of the pipeline. In at least one of the various embodiments, thedata chunks that exit the pipeline may be index data chunks and/orpreview index data chunks that have been processed and formatted byvarious worker agents in accordance with the configuration informationcorresponding to each data chunk.

In at least one of the various embodiments, as the index data chunksreach the end of the pipeline, routing agent 820 may route the indexdata chunks to their respective index stores. For example, raw datachunks from data source 802 may be processed through pipeline 810 androuted to index store 822. The determination of which data sources routeto particular index stores may be a system configuration value set by auser or determined by the indexer application.

In at least one of the various embodiments, if routing agent 820 detectsthat a data chunk may be a preview index data chunk, the preview indexdata chunk may receive further processing. In at least one of thevarious embodiments, indexer application may execute a search stringagainst the preview index data chunk to generate preview search resultsbased on the preview index data chunks.

In at least one of the various embodiments, executing the search stringmay generate a collection of preview search result data that mayformatted the same as non-preview search results produced fromnon-preview index stores. In at least one of the various embodiments,the preview search results based on the preview index data chunks may berouted to preview store 826 for storage.

In at least one of the various embodiments, preview result store 826 maybe accessed by users and/or client devices for viewing the previewsearch results in preview report views using graphical user-interfaces,web pages, consoles, or the like. In at least one of the variousembodiments, if the user is unsatisfied with the results of the previewreport views, the user may modify the candidate configurationinformation and resubmit the preview data for processing throughpipeline 810.

In at least one of the various embodiments, a user may iterativelymodify the candidate configuration information and view the resultingpreview reports until the user may be satisfied that the configurationinformation may produce satisfactory results if it is applied to data ofthe type in the preview data source.

In at least one of the various embodiments, if the user is satisfiedwith the configuration information, it may be committed to the indexingsystem for non-preview use. Also, in at least one of the variousembodiments, data of the type held in the preview source may now beprocessed by the pipeline and routed to production index stores ratherthan being routed to a preview store.

In at least one of the various embodiments, the preview data source mayinclude example data that corresponds to another live data source, orthe preview data source may be a source of production data that may beindexed if the candidate configuration information is committed to thesystem.

In at least one of the various embodiments, configuration informationmay be associated with one or more data sources. In at least one of thevarious embodiments, if candidate configuration information may becommitted, it may be available for associating with various data sourcesin the system.

It will be understood that for at least one of the various embodiments,various types of data may be received and processed as described andclaimed herein. And, at least one of the various embodiments is notlimited to processing machine data.

Having thus described the invention, what is claimed is:
 1. A method,comprising: accessing a portion of raw data from at least one datasource; causing display of one or more selectable parsing rules;receiving a first user input from a user selecting a parsing rule amongthe one or more selectable parsing rules, the parsing rule to be appliedto the portion of raw data; parsing the portion of raw data into one ormore sets of parsed data using the parsing rule, each set of parsed dataincluding raw data from the portion of raw data; causing display of atleast a portion of the one or more sets of parsed data; receiving asecond user input from the user indicating a user preference to use adifferent parsing rule; accessing a second parsing rule; processing rawdata from the at least one data source using the second parsing rule, tocreate searchable, time-stamped events, the processed raw data includingthe portion of raw data and additional raw data different from theportion of raw data; and storing the searchable, time-stamped events inan index store, wherein the searchable, time-stamped events in the indexstore are used to service search queries received from a search engine;wherein the method is performed by one or more computing devices.
 2. Themethod of claim 1, wherein the parsing the portion of raw data furthercomprises: causing display of the parsing rule.
 3. The method of claim1, wherein the display of the at least a portion of the one or more setsof parsed data includes an indication of how at least some of theportion of raw data has been parsed.
 4. The method of claim 1, whereinone or more of the selectable parsing rules were created by a user basedon existing parsing rules.
 5. The method of claim 1, further comprising:prior to receiving the first user input, causing display of the portionof raw data.
 6. The method of claim 1, further comprising: prior toreceiving the first user input, causing display of the portion of rawdata in a scrollable display.
 7. The method of claim 1, wherein thecausing the display of at least the portion of the one or more sets ofparsed data displays the at least a portion of the one or more sets ofparsed data in a scrollable display.
 8. The method of claim 1, furthercomprising: receiving a third user input selecting the second parsingrule.
 9. One or more non-transitory storage media storing instructionswhich, when executed by one or more computing devices, cause: accessinga portion of raw data from at least one data source; causing display ofone or more selectable parsing rules; receiving a first user input froma user selecting a parsing rule among the one or more selectable parsingrules, the parsing rule to be applied to the portion of raw data;parsing the portion of raw data into one or more sets of parsed datausing the parsing rule, each set of parsed data including raw data fromthe portion of raw data; causing display of at least a portion of theone or more sets of parsed data; receiving a second user input from theuser indicating a user preference to use a different parsing rule;accessing a second parsing rule; processing raw data from the at leastone data source using the second parsing rule, to create searchable,time-stamped events, the processed raw data including the portion of rawdata and additional raw data different from the portion of raw data; andstoring the searchable, time-stamped events in an index store, whereinthe searchable, time-stamped events in the index store are used toservice search queries received from a search engine.
 10. The one ormore non-transitory storage media of claim 9, wherein the parsing theportion of raw data further comprises: causing display of the parsingrule.
 11. The one or more non-transitory storage media of claim 9,wherein the display of the at least a portion of the one or more sets ofparsed data includes an indication of how at least some of the portionof raw data has been parsed.
 12. The one or more non-transitory storagemedia of claim 9, wherein one or more of the selectable parsing ruleswere created by a user based on existing parsing rules.
 13. The one ormore non-transitory storage media of claim 9, further comprising: priorto receiving the first user input received via the graphical userinterface, causing display of the portion of raw data.
 14. The one ormore non-transitory storage media of claim 9, further comprising:receiving a third user input selecting the second parsing rule.
 15. Anapparatus, comprising: a raw data selector, implemented at leastpartially in hardware, that accesses a portion of raw data from at leastone data source; a display subsystem, implemented at least partially inhardware, that causes display of one or more selectable parsing rules; auser input receiver, implemented at least partially in hardware, thatreceives a first user input from a user selecting a parsing rule amongthe one or more selectable parsing rules, the parsing rule to be appliedto the portion of raw data; a raw data parser, implemented at leastpartially in hardware, that parses the portion of raw data into one ormore sets of parsed data using the parsing rule, each set of parsed dataincluding raw data from the portion of raw data; wherein the displaysubsystem causes display of at least a portion of the one or more setsof parsed data; the user input receiver receives a second user inputfrom the user indicating a user preference to use a different parsingrule; a parsing rule selector, implemented at least partially inhardware, that accesses a second parsing rule; the raw data parser, inresponse to receiving a second user input, processes raw data from theat least one data source using the second parsing rule, to createsearchable, time-stamped events, the processed raw data including theportion of raw data and additional raw data different from the portionof raw data; and an event storage device, implemented at least partiallyin hardware, that stores the searchable, time-stamped events in an indexstore, wherein the searchable, time-stamped events in the index storeare used to service search queries received from a search engine. 16.The apparatus of claim 15, wherein the display subsystem causes displayof the parsing rule.
 17. The apparatus of claim 15, wherein the displaysubsystem causes display of the at least a portion of the one or moresets of parsed data and includes an indication of how at least some ofthe portion of raw data has been parsed.
 18. The apparatus of claim 15,wherein one or more of the selectable parsing rules were created by auser based on existing parsing rules.
 19. The apparatus of claim 15,wherein the display subsystem, prior to receiving the first user inputreceived via the graphical user interface, causes display of the portionof raw data.
 20. The apparatus of claim 15, wherein the user inputreceiver receives a third user input selecting the second parsing rule.